且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

在PHP SDK中使用IAM角色时出现问题

更新时间:2023-09-11 22:28:16

我只是想为可能会遇到这种情况的其他人扩大一点.

I just wanted to expand a bit on this for anyone else that may end up in this situation.

然后在创建客户端时不要使用配置文件行.如果您确实在客户端中指定了配置文件,它会告诉SDK使用来自凭据ini文件的配置文件覆盖您在客户端中设置的任何形式的凭据.

Then don't use the profile line when creating a client. If you do specify profile in your client it tells the SDK to override any form of credentials you set in the client with a profile from the credentials ini file.

在PHP SDK V3文档中已提及(但有些掩饰): https://docs.aws.amazon .com/aws-sdk-php/v3/guide/guide/configuration.html#profile

Mentioned (but buried a bit) in the PHP SDK V3 documentation here: https://docs.aws.amazon.com/aws-sdk-php/v3/guide/guide/configuration.html#profile

$client = new SqsClient([
    'profile' => 'default', // <--- Don't use this line if you're using IAM Roles for credentials
    'region' => 'us-west-2',
    'version' => '2012-11-05'
]);

误导性文档


PHP SDK文档建议在EC2实例的所有其他其他凭据之前使用IAM角色.很好,很合情理.例如,这种情况会给新手带来误导;

Misleading Documentation


The PHP SDK documentation recommends using IAM roles above all other credentials for EC2 instances. That's fine and makes total sense. The misleading part to new comers is for example this scenario;

  1. 说新手SDK的人会在入门"部分中阅读基本SDK用法".
  2. 根据文档设置S3客户端进行测试.
  3. 一旦他们拥有可用的S3代码,开发人员便决定跳至代码示例部分,以为其他AWS服务设置客户端.

这里的问题是所有代码示例(S3示例除外)都包含配置文件设置,该配置文件设置破坏了IAM角色凭据方法.

The problem here is that all of the code examples (with the exception of the S3 examples) contain the profile setting that breaks the IAM role credential method.

这些代码示例至少应参考配置文件的功能.

The code examples should at least have a reference to what profile does.